Does procurement law stand in the way of sovereign ICT or data sovereignty?

11 februari 2026

The dependence on Big Tech and other American suppliers is very high. Not only are many products and services from the USA used, yet seemingly European IT is often very intertwined with American components. Or what about the underlying hardware with regular Chinese origins. Given all the geopolitical turmoil, this worries many organizations. Steps are being considered toward more sovereign ICT. The only perception is that procurement law stands in the way of this. Is this true now?

Mark Jansen
Mark Jansen
Lawyer - Associate Partner
Tony van Wijk
Tony van Wijk
Lawyer - Partner
In this article

High tech dependence on USA and China

The top 10 large technology companies are dominated by parties from America and Asia. Europe actually plays little to no role here.

Our companies, institutions and governments make massive use of software from parties like Microsoft and Oracle, of the infrastructure (cloud) from parties like AWS and Google, and of hardware from parties like Cisco and Apple. Moreover, the software is less and less often "running" locally, but rather on infrastructure managed (directly or indirectly) by such foreign parties. And what about integrated web services in software, which communicate 'under water' with parties abroad (even though the software itself is local).

Why was dependence on Big Tech accepted for a long time?

This is a process that has only accelerated in recent years, often because outsourcing to a party 'in the cloud' is cheaper. And partly because in ICT the economic laws of economies of scale play a very strong role, parties that are already very large often turn out to be able to make a cheap offer. You would be a thief of your own wallet if you did not go for the cheapest provider.

For a long time, this did not worry many organizations much. There was often a focus on regionalization of data (i.e., data processing on European soil). However, these agreements were never really blissful, now that foreign companies are always bound by their own local legislation and that legislation can make it necessary to hand over data.

Europe comes up with whole set of additional rules but no ban

Step by step, however, concerns about these developments are growing. In recent years, for example, the European Union came up with the EU Digital Agenda. A whole set of rules to strengthen Europe in the areas of cyber security, data autonomy and better competition.

At the same time, it is striking that the same set of rules does not include a ban on outsourcing IT to foreign parties. In this sense, the European legislator still believes in the laws of the free and also international market. This market is curbed, but not totally squeezed.

In that sense, we are still at the situation as I once aptly heard Prof. Bart Jacobs summarize: "We run American software on Chinese hardware, governed by European rules."
However, worries are increasing
Concerns are growing hand over fist. A survey last year by iBestuur and Binnenlands Bestuur showed that many municipalities are concerned about their dependence on Big Tech. This was then echoed at the Government 360 conference, among others.

Recently, things have suddenly started to move fast. Nieuwsuur devoted several items to the topic (see the broadcast of February 4), Limburg municipalities publicly expressed their concerns, the municipality of Haarlem announced that it wants to get rid of American parties and the municipality of Amsterdam presented an action plan to break the dependence on Big Tech.

And just as concerns are growing, and more and more parties are taking action, this development also colors what you can expect from a good administrator in this area. For while the law may not "hard" prohibit outsourcing abroad, there is still the open norm that a director must act with care.

How do you do this, however?

The move to a more sovereign/local IT infrastructure is not made overnight. As mentioned, there is a strong interdependence with external IT, such as in the form of infrastructure, but also think of software that calls all kinds of external web services "under water. This thus requires first of all a good inventory.

It will also be necessary to check whether the existing contracts can be terminated. IT contracts are notoriously one-sided, and that is certainly true of Big Tech contracts. Early termination is by no means always easy. However, that is not to say that it is impossible.

And, of course, the question is what is the alternative? Are the local alternatives there, are those alternatives not also intertwined with foreign providers, and how do you actually handle the switch? Here we know from experience that (much) more is possible than many people think.

Is it allowed under procurement law?

A common misunderstanding is that procurement law would make it impossible to exclude companies or products from certain countries. We are happy to dispel that misunderstanding.

First of all, companies/bidders based in countries that are not party to the Government Procurement Agreement (GPA) may be excluded. China is not a member so companies based in China cannot invoke European procurement law. In practice, this (indeed) offers little relief because products from such "third countries" are usually offered by European companies/bidders. They can of course invoke European procurement law.

When invoking European procurement law, they often found the Dutch courts (and the Committee of Procurement Experts) on their side. Indeed, they ruled that two conditions would (still) apply that could rarely be met in practice, namely (i) that no precise description (of the specifications) is possible and (ii) that equivalent products must always be accepted. In early 2025, however, the European court made it clear in the "DYKA ruling" that these two conditions do not apply if there is an objective justification. Due to geopolitical developments, there is an increasing/ evident interest in taking measures to safeguard national/ European security. We therefore expect that the prescription of European products or the prohibition of certain non-European products (from unsafe countries) will be increasingly well-founded and therefore successfully defended in court.

It is not easy, but it can be done

To speak in the motto of one of the parties in the new cabinet: it can be done. The issue is multifaceted and complex, but the law does not prevent the procurement of sovereign IT. Indeed, it is even questionable whether, given standards of care that rest on administrators, it should not be expected of administrators to have at least very much thought about this topic (or even to demand sovereign IT from now on). There will be developments on this in the near future, we expect.

Do you have any questions about this? Feel free to contact us.

Related

New Digital Rules, an Old Boardroom Question: Are We Still in Control?

In recent years, digital regulations have often been presented as a flood of new obligations: NIS2, the AI Act, the Data Act, the Cyber Resilience Act. For...

What IT Suppliers Can Learn from a Tram Dispute

At first glance, a contract for the delivery of trams seems to have little to do with IT contracts. Yet a recent ruling by the District Court of The Hague...

The Digital Omnibus: Implications for AVG, Data Act & AI Act

The European legislator wants to draw a line under many digital regulations. The Digital Omnibus is essentially a major maintenance of the European digital...
Monitoring in Defence and Security

Defence & Security: Key considerations around increased investment in cybersecurity

A Europe-wide decision has recently been made to invest up to 5% of GDP in defence and related sectors. This means that significant funds will gradually be...
Defence & Security legal services

Defence & Security: Investing, innovating and protecting

In light of rising geopolitical tensions, NATO member states have recently agreed to a new NATO benchmark of 5% of GDP. The Dutch defence and security sector...

Limiting vendor lock-in: how do you maintain freedom and flexibility in a digital world?

In an increasingly digital world, we rely on numerous third-party vendors for their software, cloud solutions and other IT services. This collaboration often...
No posts found